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DIALYSIS MACHINES WITH TOUCH SCREEN USER INTERFACE 

5 

NOTICE REGARDING COPYRIGHT 

10 A portion of the disclosure of this patent document contains matter subject to 

copyright protection. The copyright owner has no objection to the facsimile reproduction 
by anyone of the patent disclosure, as it appears in the Patent and Trademark Office files 
and records, but otherwise retains all copyright rights whatsoever. 

1 5 BACKGROUND OF THE INVENTION 

A. Field of the Invention 

This invention relates to the field of medical instruments and their user 
20 interfaces, and more particularly to a user interface and control method for a medical 
instrument such as a dialysis machine. 

B. Description of Related Art 

25 Dialysis machine are used for treating patients with inadequate kidney function. 

Hemodialysis machines typically include, among other things, an extracorporeal blood 
circuit comprising an arterial line, a blood pump, a dialyzer having a semipermeable 
membrane and a venous line. Blood is removed from the patient and pumped by the 
blood pump through the arterial line to the blood compartment of the dialyzer, where 

30 toxins and excess water are removed fi-om the patient's blood. A dialysate solution is 
circulated on the other side of the membrane and carries away the toxins and removed 
water. The blood is then returned to the patient via the venous line. Peritoneal dialysis 

1 
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machines prepare a dialysate solution which is introduced into the patient's peritoneal 
cavity. 

Dialysis machines typically have some sort of controls to regulate the operation 
of the machine. Such controls in the past were a rather unattractive and hard to use set 
5 of dials and switches that required trained medical professionals to use properly. More 
contemporary machines have a single user interface to allow a patient or medical 
practitioner to interact with the machine and adjust machine operation or treatment 
parameters, e.g., blood pump rate, dialysate temperature or flow rate, treatment time, 
heparin pump rate, etc. 

10 The patent to Grogan et al., U.S. No. 5,326,476, which is incorporated by 

reference herein, describes a touch screen that is used to control the operation of a 
hemodialysis machine. The touch screen is connected to a host microprocessor which 
controls operation of most of the active components of the machine. When the user 
wishes to change a treatment parameter, the user touches an icon on the touch screen and 

15 a key pad with an enter key pops up on the screen. The user enters the new value by 
touching the numbers on the key pad and pressing the enter button on the key pad. A 
verify button is then pressed on the touch screen if the user wishes to confirm the 
change. The patent also briefly describes a method of touching the touch screen to 
! program a time-varying parameter, such as ultrafiltration removal over the course of a 

20 dialysis session. 

User interfaces that solely depend on a touch screen as a means for entering and 
confirming parametric values, such as described in the Grogan et al. patent, are 
vulnerable to failures in the touch screen display. If the touch screen is defective, the 
computer system may not receive the correct information from the touch screen or 
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interpret the information incorrectly. The present invention was designed to provide for 
redundancy and safety verification of parametric value changes independent of the 
operation of the touch screen, and thereby avoid accidental or unintended changes of 
parameters in the event of a defect in the touch screen. 

5 The user interface of the present invention provides for the combination of a 

touch screen, and at least one hard key that are separate and apart from the touch screen, 
whereby both the touch screen and the hard keys have to be pressed to enter and verify a 
change in a parametric value pertinent to the treatment or the operation of the machine. 
The computer control system for the machine also uses host and safety backup 

10 microprocessors which are responsive to the touch screen and hard keys to perform 
internal verification and confirmation checking procedures to verify that the change in 
parametric value requested by the user is proper. These features combine to offer safety 
benefits, robustness, and ease of use that are believed to be superior to user interfaces 
known in the prior art. 

15 Another object of the invention is to provide a user interface design for a 

medical instrument that is especially easy to use by a person that is not a technically 
trained medical professional, i.e., by the patient or a member of the patient's family. 
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SUMMARY OF THE INVENTION 

A system for controlling the operation of a dialysis machine is provided 
comprising in combination a user interface and a central computer control system. The 
user interface comprises a touch screen that displays messages and information as to the 
5 machine status to a user, and permits the user to touch the touch screen to select 
parametric values pertinent to operation of the machine. The user interface further 
includes at least one hard key off of the touch screen. The touch screen prompts the 
user to press the hard key to signify that the selection of the parametric value by the 
user has been completed. 

10 The central computer control system controls operation of the machine and is 

responsive to the touch screen and the hard key. The control system comprises a host 
central processing unit and a safety central processing unit (both comprising 
microprocessors) operatively connected to each other so as to enable an exchange of 
information related to the selected parametric value. 

15 When the user presses the hard key to indicate that the selection process is 

complete, this action causes the host and safety microprocessors to undergo a 
verification routine whereby the selected parametric value is checked for 
appropriateness for a patient connected to the machine so as to prevent changes to the 
parameter potentially harmful to the patient. If the verification routine results in a 

20 positive result, the process of changing the parameter may move forward. 

In a preferred embodiment, the hard key is directly wired to the safety central 
processing unit. The user interface also preferably comprises first, second and third hard 
keys, each of them directly wired to the safety central processing unit. The hard keys 
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are preferably given a distinctive appearance so as to enable the user to identify each 
hard key with a distinct functional attribute, e.g., stop, confirm, or entry. 
In another aspect of the invention, a method of operation of a dialysis machine is 
provided, the machine having a central computer control system and a user interface 

5 having a touch screen enabling a patient, by touching the touch screen, to select 
parametric values in a process of changing a parametric value pertinent to operation of 
the machine or to a dialysis treatment of a patient connected to the machine. The 
method comprises providing the user interface with at least one hard key and connecting 
the hard key directly to the central computer control system. After the user has selected 

10 the parametric value by touching the touch screen, the user is prompted to press the 
hard key to either 

(a) enter the parametric value selected, or, 

(b) if entry of the selected parametric value was accomplished by touching the 
touch screen, confirm the entry of the parametric value. 

15 In accordance with the above method, a failure in the touch screen to respond to 
touching of the touch screen to either enter or confirm parametric value changes may be 
avoided. 

In one embodiment of the invention, the central computer control system for the 
machine preferably includes host and safety CPUs, each comprising a microprocessor. 
20 The host and safety microprocessors each have has a first memory such as a random 
access memory (RAM) and a second memory, such as a hard disk, storing machine 
operation instructions and treatment prescriptions. In one aspect of the invention, a 
method is provided for using the touch screen, two hard keys, the first and second 
memories and host and safety microprocessors to change parameters to provide 
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enhanced redundancy and safety capabilities and avoid single point failures in the touch 
screen, host microprocessor, or host memories. The method comprises the steps of: 

a) touching the touch screen to select a parametric value; 

b) pressing the first hard key to enter the selected parametric value, the computer 
system responsively storing the selected parametric value in the first memory is 
associated with the host microprocessor; 

c) in response to pressing the first hard key, transmitting data associated with the 
selected value firom the host microprocessor to the safety microprocessor and 
implementing a verification routine in the safety microprocessor. The safety 
microprocessor checks the parametric value for appropriateness for a patient connected 
lo the machine so as to prevent changes from being implemented to the parameter 
potentially harmful to the patent. 

d) If the verification routine has a positive result, the safety sends a signal back to 
the host microprocessor granting approval to the change and stores the changed 
parameter in its first memory. The touch screen then displays a message prompting the 
user to press the second hard key to confirm the change selected in step a). 

e) If the user presses the second hard key to confirm the change, the host and safety 
microprocessors stores the new value in their respective second memories. The host 
and safety microprocessors then conduct a checking procedure to insure that the new 
value has been correctly stored in their second memories. 

These and many other aspects and features of the invention will be more 
apparent from the following detailed description of preferred embodiments of the 
invention. 
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BRIEF DESCRIPTION OF THE DRAWINGS 
In the following detailed description of presently preferred and alternative 
embodiments of the invention, reference will be made to the accompanying drawing 
figures, in which like reference numerals refer to like elements in the various views, and 
in which: 

Figure 1 is an illustration of a dialysis machine having a user interface in 
accordance with a preferred embodiment of the invention. 

Figure 2 is a cross-sectional view of the user interface in an embodiment in 
which the arm connecting the user interface to the machine is attached to the lower 
cabinet of the machine; 

Figure 3 is a block diagram of a control system governing the operation of the 
machine of Figure 1. 

Figure 4 is an elevational view of the user interface for the machine of Figure 1, 
showing the general organization of the screen into discrete regions associated with 
different general functions. 

Figure 5 is an illustration of the user interface of Figure 4, with the touch screen 
displaying a dialysis prescription during a treatment session, the display requesting the 
patient to press an icon associated with a treatment parameter if they wish to change a 
parameter. 

Figure 6 is an illustration of the user interface of Figure 1 after the user has 
pressed the icon shown in Figure 5, showing up and down arrows that permit the user to 
select a different value for the treatment parameter. 
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DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENT 

Figure 1 is an illustration of a dialysis machine 10 having a user interface 12 
which may be employed in practicing the invention. The dialysis machine 10 in the 
preferred embodiment is a machine suitable for use outside of a traditional dialysis 

5 clinic setting, such as the home, nursing home or self-care clinic envirorunent. The user 
interface 12 is designed to be easy to use by a person other than a trained health care 
professional, such as the patient or a family member of the patient. 

The preferred user interface 12 comprises a transparent touch screen 14, a 
display positioned immediately behind the touch screen 14, and a set of three hard keys 

10 or buttons 16, 18, 20 positioned below the touch screen 14. The touch screen 14 and 
hard keys 16, 18 and 20 are incorporated into a rigid housing 15 that is mounted to the 
distal end of a moveable arm 30. 

The machine 10 has a central computer control system 100 shown in block 
diagram form in Figure 3. The control system 100 is programmed to display 

15 information and messages to the patient or user of the machine on a display 14' (Figure 
2) immediately behind the touch screen surface 14. The control system 100, in 
cooperation with the hard keys 16, 18, 20 and touch screen 14, permits the user to 
change machine settings and enter information and otherwise control the operation of 
the machine before, during and after the treatment time. 

20 The dialysis machine 10 of Figure 1 has a water treatment module 23 and a 

dialysate preparation module 25 contained within the lower compartment 22 of the 
machine. These modules 23, 25 play no part in the present invention, and are described 
in detail in U.S. Patent 5,591,344 to Kenley et al. and assigned to Aksys, Ltd., the 
assignee of the present invention, and in PCT application publication no. WO 
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96/25214. These references describe a preferred dialysis machine suitable for use in the 
home environment. The Kenley et al. U.S. Patent No. 5,591,344 and published PCT 
application no. WO 96/25214 are both fully incorporated by reference herein. 
Additionally, the manner in which the dialysate solutions are prepared and circulated 
5 through the dialysate circuit is not particularly important to this invention and is well 
known in the art, and may be as described in the above-referenced Kenley et al. patent, 
or as described in the above-referenced Grogan et al. patent, or otherwise. Additionally, 
the user interface and method of operation is applicable to other typos of medical 
instruments. 

10 The dialysis machine 10 further includes an extracorporeal circuit 24 mounted 

above the lower cabinet 22. The extracorporeal circuit is housed behind a door 27 in 
an enclosure 26 that is mounted to a turntable 28. The turntable 28 is moveably 
mounted to the top of the lower cabinet 22 such that the turntable 28, enclosure 26 and 
extracorporeal circuit 24 are capable of rotation as a unit relative to the lower cabinet 22 

15 about a vertical axis. The purpose of this rotation is to allow the extracorporeal circuit 
within the door 27 to be placed directly opposite a patient sitting next to the machine 10. 

The details of the extracorporeal circuit 24 of the machine 10 of Figure 1 are also 
not particularly germane to the present dialysis machine user interface. Blood is 
removed from the patient and introduced into an arterial line, and pumped by a blood 

20 pump to the blood chamber of a dialyzer. Blood-borne toxins and excess water are 
removed from the blood through the membrane of the dialyzer, and the blood is returned 
to the patient via a venous line. To prevent air from being introduced into the blood 
being returned to the patient, it is conventional in the dialysis art to place an air trap in 
the venous line. A method of using the user interface 12 to adjust the level in the air 
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trap is described in a U.S. patent application of Rodney S. Kenley et al.. Serial No. 

, which is incorporated by reference herein. Details of the extracorporeal circuit 

illustrated in Figure 1 can be found in the published PCX application of Kenley et al., 
publication no. WO 96/25214 and in the Kenley et al. U.S. Patent No. 5,591,344. 
5 The proximal end of the moveable arm 30 may be either attached to the 

enclosure 26 via a hinge 29 as shown in Figure 1, to the tumtable 28, or to the lower 
cabinet 22 as shown in Figure 2, such as to a comer of the upper surface of the lower 
cabinet, e.g., comer 32. Preferably, the user interface arm 30 is connected to the rest of 
the machine 10 via a hinge 29 or other suitable means such that the arm 30 can rotate 

10 about the vertical axis so as to position the user interface in a convenient orientation 
relative to a patient sitting or reclining next to the machine. 

The user interface 12 of Figure 1 is shown in cross section in Figure 2, along the 
lines 2-2 of Figure 1, in an embodiment in which the arm 30 is connected to the upper 
surface of the machine housing 22 at the comer 32 A hinge 29 connects the proximal 

15 end of the arm 30 to the housing 22 and allows the arm 30 to pivot about a vertical axis. 
A second hinge 49 at the distal portion of the arm 30 allows the user interface 12 to 
pivot about a vertical axis. A third hinge 47 in the user interface housing 15 allows the 
user interface 12 to tilt about a horizontal axis, i.e., to tilt down towards the patient if the 
patient is seated or reclining in bed, or up if the patient is standing. 

20 The extreme lower portion of the user interface housing 15 has a lower handle 

portion 17 below the hard keys 16, 18, 20. The handle 17 has an extreme lower lip 
17A that allows the user to grasp the interface housing 15, and a relatively large surface 
17B extending across a substantial portion of the width of the housing that allows the 
user to push the user interface back, causing the arm 30 to move about the hinge 29, or 
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rotate about the tilt hinge 47. The addition of a handle feature as described allows the 
user to interact with a specific portion of the user interface 12 away from the touch 
screen 14, whereby the user is less likely to push the touch screen 14 to move the touch 
screen about and accidentally operate the controls of the machine 1 0. The lower lip 1 7 A 

5 and front surface 17B thus enable a user to manually manipulate the user interface 
housing 15 in a manner to cause rotation of the user interface about the housing axis H 
of Fivrurcs 1 and 3, the arm axis A, and the tilt axis T. 

TIk from of the user interface housing 15 is substantially flat and includes the 
suhsiantuiU transparent touch screen 14 per se. The display 14' for the touch screen is 

10 placed uuhm ihc housing immediately behind the touch screen 14. The hard keys 16, 
IS, 3o arc hutli mto the front surface of the housing 15 immediately below the touch 
screen 14 

Figure 3 IS a block diagram of a computer control system module 100 installed 
in the lower cabinet 22 of the machine 10 that governs the operation of the machine. 

15 The use of a central computer control module to control active components of a dialysis 
machine is well known in the art and described in the above-referenced Kenley et al. and 
Grogan ci al. patents. The module 100 controls the operation of the touch screen display 
14' to display messages and information conceming the status of the machine and 
treatment. The module 100 operates the touch screen display 14' to prompt the user to 

20 touch the touch screen 14 and the hard keys 16, 18 in the process of changing parameters 
or inputting information into the computer system 100. 

The touch screen 14 interfaces with the patient or other user and is provided for 
inputting commands or information from the patient into a human interface (HI) board 108 
and displaying messages on the display 14' immediately behind the touch screen 14 
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surface in response to commands from a host Central Processing Unit (CPU) 1 10 from 
the HI board 108. 

The hard keys 16, 18 and 20 are each a pair of physical, electrically isolated 
switches. One switch in each of the hard keys 16, 18, and 20 is preferably directly 

5 connected, and essentially hard wired, to a backup or safety CPU 1 1 6, and the other switch 
in the hard keys is connected to a host CPU 1 10. The switch for the emergency stop hard 
key 20 for the host CPU 1 10 is preferably directly connected to host CPU 1 10 from the HI 
board 108 over a separate conductor, as shown by the dashed line 101. 

While FIG. 3 shows the connection between the hard keys 16, 18 and 20 going to 

10 the safety CPU 1 16 via the HI board 108 and conductor 105, the connection between the 
hard keys and the safety CPU 1 16 is considered a direct connection since the only fimction 
performed by the HI board 108 is debouncing and electrical interfacing the switch signals 
before they are sent to the Safety CPU 1 16. The connection is also considered a "direct 
connection" in the sense the signal path is intentionally designed to not share any circuitry 

1 5 with the Host CPU 1 1 0 or the microprocessor on the HI board 1 08. 

The switch for the Red hard key 20 that is directed to the host CPU 1 10 is directly 
connected to the host CPU via the HI board 108, which performs debouncing and 
electrical interfacing, but the circuit does not share any other circuitry on the HI board 108 
and the status of the switch is sent to the host CPU over the conductor 101 as described 

20 above. The switch for the host CPU 110 for the green and blue hard keys 18 and 16, 
respectively, are subject to debouncing by the microprocessor on the HI board 108, and the 
status of the switches is sent over the bus 103. 

A set of indicators 104, including lights and audio indicators, a buzzer 121, and a 
speaker 106, alert the patient to abnormal conditions in the machine 10, and provide 
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information as to the status of the modes of operation of the machine. The indicators 104 
receive input signals from the host or safety CPU via the HI board 108. The buzzer 121 
receives input signals from the safety CPU 116. Thus, audio and visual alarm activities 
are split among the two microprocessors 110, 116 in case one of them fails to work 
5 properly. 

The host CPU 11 0 is connected via high speed digital data busses 1 1 1 and 1 1 3 to a 
driver board 112 and an analog board 114. The host CPU 110 comprises a 
microprocessor and implements a software program governing the operation of the 
machine stored in a hard disk memory 130 or a read only memory (not shown). The hard 

10 disk 130 stores other operational information, such as the patient's prescription, data from 
the passive components, and data input from the patient via the touch screen. An analog 
board 114 contains analog to digital converters for converting incoming analog signals 
from the passive sensors in the machine 22 (such as thermistors, pressure sensors and 
conductivity cells) into digital signals. The driver board 112 receives commands from the 

15 CPU 1 10 and sends the commands to the valves, pumps, heaters, motors, and other active 
components of the machine (represented by 120) to cause the components to change their 
status, e.g., commence or cease operation or change rate, as in the case of a pump, or open 
and close, as in the case of a valve. The signals from the passive components 122 of the 
system, for example, the conductivity sensors, pressure transducers, thermistors, etc. 

20 provide their inputs to the analog boards 114 and 118. The CPU 110 and driver board 
1 12 together act as a controller for the active components. 

The analog board 1 18 provides digital information on a bus 1 17 to the safety 
CPU 116. The safety CPU 116 comprises a microprocessor and acts as watchdog of 
critical system sensors, and provides enable signals to the driver 112 that allow certain 
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driver commands to issue to the active components 120 (such as signals to the valve and 
air pump to raise or lower the level in the drip chamber in the extracorporeal circuit). 
These features are described in more detail below as they relate to the changing of machine 
parameters. Communications between the safety CPU 116 and host CPU 1 10 are passed 
5 on data bus 107, The safety CPU 1 16 activates a buzzer or other suitable alarm 121 if 
certain alarm conditions are present in the machine. 

Both the host and safety CPUs 110 and 116 have an associated random access 
memory 132 and 134, respectively, for use in processing input information from the touch 
screen 14, for temporary storage of data, and for performing other tasks. In a preferred 

10 embodiment, the host CPU 110 and hard disk 130 are based on an off-the-shelf IBM 
compatible personal computer platform based on an Intel 386 or 486 microprocessor, or 
the equivalent. A similar microprocessor platform may be used for the safety CPU 116. 
Of course, other types of microprocessor platforms may be used. The safety CPU 1 1 6 also 
has its own hard disk memory 123. Note that the Safety and Host CPUs 116 and 1 10 do 

15 not share a hard disk, but rather have their own hard disk, for safety and redundancy 
reasons. 

The host CPU 110 preferably has a modem and telephone line interface, a local 
area network (LAN) gateway card and interface and/or an RS-232 serial port (not shown) 
for allowing the machine 1 0 to receive and send messages to remote locations by a suitable 
20 communication link. The choice of which type of input/output interface will depend on 
where the machine 10 is installed (e.g., the home (modem), in a hospital (LAN interface), 
in a nursing home (modem and/or RS-232 and/or LAN). Potential entities that may wish 
to access infomiation from the machine include a physician or nurse, the machine 
manufacturer, a service technician, and a remote monitoring facility such as a central 
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Station monitoring a plurality of machines. Preferably, machine status and treatment 
information is stored in the hard disk 130 and is accessible to the outside via the modem 
and host CPU 110 using an interactive program nmning on the host CPU 110 and at the 
remote site. The host CPU computing platform 110 also preferably implements a 
Microsoft ™ graphical user interface operating system, and also Internet access software 
to allow messages to be sent to and retrieved from the machine 10 via the Internet. 

Figure 4 is an elevational view of the user interface 12 of Figure 1 showing a 
display on the touch screen 14 that is used prior to the start of the treatment. The 
illustrated display, and preferably all of the displays for the user interface, is organized 
into discrcie zones or portions extending across the width of the display. This 
organizational scheme assists the user to know where to look on the display for certain 
functions, icons, and information throughout all of the displays. One portion is 
preferably devoted to displaying instruction and status information to the user. Another 
is preferably devoted to displaying primary treatment and machine activities and 
functions. A third portion is preferably used for secondary machine activities and 
functions. 

An embodiment of this general organizational scheme is shown in Figure 4. The 
display has an upper portion 60 devoted to secondary activities and functions, and 
includes an icon 62 for a guide, which allows the user to gain information as to the 
machine when the icon 62 is pressed, a messages icon 64 indicating whether the patient 
has received new messages (e.g., via the Internet or public telephone network), and a 
problem report icon 66. The problem report icon 66 is a means for the machine to 
notify the patient of problems in a non-treatment mode. The screen display also has a 
time and day section 68. 
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The middle portion of the display 70 conveys status information to the patient, 
such as when the next treatment time is to begin. The portion 70 is given a paper pad 
type of look to reinforce the role played by this portion of the screen. 

The lower portion 72 has a set of icons related to primary treatment and machine 
5 functions. These icons, when pressed, lead to additional screens that allow the patient 
to obtain information or enter data as to basic machine and treatment functions. These 
icons include an icon indicating treatment information 74, a dialysis schedule icon 76, a 
prescription icon 78 and a machine set-up icon 80. 

When the user wishes to enter information into the machine from any of these 
10 menus, the user presses the touch screen 14 to navigate through various screen displays 
until they arrive at the appropriate screen for the action they wish to take. 

As noted above, the user interface of Figure 4 has at least one hard key (a 
physical button) positioned below the touch screen 14. Three hard keys are preferably 
provided, each with a distinctive visual appearance to assist the user to identify the hard 
1 5 key with a distinct functional attribute: a blue hard key 16, a green hard key 1 8 and a red 
hard key 20. The hard keys 16, 18 and 20 preferably consist of two electrically 
independent switches, one sending signals to the safety CPU 1 16 and the other sending 
signals to the HI board and host CPU 1 10 as described above. 

The blue hard key 16 is connected to the host CPU 110 via the HI board 608, and 
20 is hard wired to the safety microprocessor 116. The blue hard key 16 is solely 
associated with an entry function. The user presses the blue hard key 16 when the user 
is finished editing a parameter during the process of changing parametric values for the 
machine. The blue hard key 16 is directly hard wired to the safety CPU 1 16 due to the 
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fact that the safety CPU 116 is involved when parametric values are changed, as 
discussed below. 

The green hard key 18 is a means for the user to confirm parametric value 
changes and some of the mode transitions of the machine 10. The green hard key 18 is 

5 connected to the host CPU 110 via the user interface software and hardware (i.e., HI 
board 108) and is hard wired to the safety CPU 1 16. The meaning associated with the 
pressing of the green hard key 1 8 also depends on the context of the current display and 
the current state of the machine 10. Due to safety considerations, the safety CPU 1 16 
must have an independent means for determining the user's intention to change 

10 parametric values, i.e., independent of the touch screen or the host CPU, hence the green 
hard key 18 is directly connected and essentially hard wired to the safety CPU 1 16. 

The red hard key 20 is a means for the user to issue an "Immediate Stop" 
command to the machine 10. The host and safety CPUs 110 and 116 respond by 
disabling a predetermined group of active components of the machine that leaves the 

15 machine in a patient-safe mechanically stopped condition. The meaning of the red hard 
key 20 is always the same regardless of the state of the machine 10. Unlike the blue 
and green hard keys, the red hard key 20 is directly connected and essentially hard wired 
to both the host and safety CPUs. Both microprocessors have the ability to disable the 
same group of active components, and will, redundant with each other, disable the active 

20 components. 

As noted above, in order to assist the user to become familiar with the functions 
provided by the hard keys, they are preferably given a different color. Since one of the 
keys 20 is associated with an emergency stop function it is given a red color. The other 
keys 16 and 18 have more latitude in their selection of color, and we prefer to use a 
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green key 1 8 to be generally identified with a confirmation function. The third key 1 6 
is identified with an entry fiinction, and is blue in the preferred embodiment. To assist 
further in reinforcing their different fimctions, they may be given different shapes, e.g., 
octagon, square and triangle. Other colors and shapes are of course possible. 

5 In accordance with the invention, the touch screen 14 and hard keys 16 and 18 

are used in a process to adjust certain parameters pertinent to the operation of the 
machine or the dialysis treatment. Figure 5 is an illustration of the user interface 12 
showing a display on the touch screen 14 that can be accessed before or during the 
dialysis session. The touch screen 14 displays a message prompting a user to touch an 

10 icon 140 if they wish to change the level of the drip chamber in the extracorporeal 
circuit. When this icon 140 is pressed, an illustration of the blood drip chamber is 
displayed on the screen and the user indicates the current level in the illustration. The 
host CPU determines from the indicated level whether the level needs to rise or fall, and 
by approximately how much, to bring the level back to a predetermined desired level. 

15 This process and variations thereto are described in further detail in the above- 
referenced Kenley et al. patent application filed concurrently, serial no. 

, incorporated by reference herein. 

The display of Figure 5 further includes several icons 142, 144, 146, 148, 150 
and 1 52 that display current treatment settings in numerical form. The region 1 54 below 

20 the icons 142, 144, etc. can be used to display other information or to allow the patient 
to navigate to the previous screen or additional screens, obtain information, or report 
problems. 

Tlie display of Figure 5 requests the patient to press an icon associated with a 
treatment parameter if they wish to initiate the process of changing the parameter. When 
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the user presses an icon, for example, the treatment length icon 148, the display is 
modified to that shown in Figure 6. Up and down arrows appear below the icons 142, 
144, 146 et aL adjacent to the selected treatment parameter and the treatment parameter 
icon 148 is highlighted, e.g., made a brighter or a different color from the other icons. 
5 The user presses the up or down buttons 1 80, 1 82 to select the new value. The user 
then signifies that the editing is complete by pressing the blue hard key 16. After 
verification procedures are performed, the user is then prompted to confirm the change 
by pressing the green hard key 18. 

In the preferred embodiment of the invention, the above process invokes 
10 operations with both the host and safety CPUs 1 10 and 1 16 to provide redundancy and 
safety features, which will now be described in detail in conjunction with Figures 3, 5 
and 6. 

The user touches one of icons 142, 144, 146, 148, 150 and 152 to indicate which 
parameter they wish to edit. A pair up and down arrows such as shown in Figure 6 then 

15 appear. The user presses the up and down icons to select the new parametric value. In 
response to a prompt, the user indicates that the editing process is complete by pressing 
the blue hard key 16. An alternative would be to prompt the patient to press the green 
hard key, but this is a less desirable alternative since association of the green hard key 
1 8 with a confirmation function would be diluted; A further possibility would be to 

20 press the activated icon, e.g., icon 144, a second time in response to a prompt. The 
preferred action of pressing the hard key 16 off the touch screen 14 initiates storage of 
the changed parametric value into the working RAM 132 for host CPU 110 (Figure 3). 
A CRC (Cyclical Redundancy Check) value is calculated by the host CPU 110 for the 
set of parametric values currently displayed on the screen. The CRC check is 
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calculated by the host CPU 110 only (at this point), and only in response to the pressing 
of the blue or entry hard key 16. 

The following information is then sent from the host CPU 11 0 to the safety CPU 
1 16 over the bus 107 in response to a pressing of the entry hard key 16: a unique screen 
5 identifier associated with the display currently on the touch screen 14, the current values 
of all the modifiable parameters displayed on the screen, a unique parameter identifier 
associated with the parameter to be changed, and the calculated CRC value. The data is 
stored in the Safety CPU 1 16's RAM 134. 

The safety CPU 116 then performs a verification routine to determine that the 
10 requested change to the parameter is appropriate for the patient and is consistent with 
the current status of the machine 10 and current display, and prevent any changes that 
could be harmful to the patient. Specifically, in a preferred embodiment, the safety CPU 
116 verifies that the screen displayed could be displayed given the current state of the 
machine 10. It also verifies that only one parametric value, of all the modifiable 
15 parametric values associated with the current screen, has changed. It also verifies that 
the parameter identified by the host microprocessor 110 is editable on the specified 
screen. If further verifies that the parameter that the host has identified as being the 
changed parameter is the same one identified by the safety CPU 116. This verification 
is done by the Safety CPU 116 using its own copy of the treatment information stored in 
20 its hard disk 123 and comparing this information with the information sent from the host 
CPU 1 10 to determine which parameter for the screen has changed. The safety CPU 
116 further verifies that the parametric value that changed passes all range, resolution, 
format and other appropriate validation and safety tests. This is accomplished by 
comparing the proposed new value with stored values on the hard disk 123 associated 
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with permissible range of values and other vaHdation criteria for the patient. The values 
stored on the hard disk 123 may be either modifiable by a doctor's prescription loaded 
into the hard disk 123 or validation or safety criteria set at the time of machine 
manufacture. Finally, the safety CPU 116 calculates a CRC on the set of parametric 
5 values currently displayed and detemiines whether the CRC value matches the CRC 
value calculated by the host CPU 110. It will be appreciated that the above specific 
verification routine is not the only possible verification routine and can be modified to 
be more or less stringent for different parameters and states of the machine. 

If the safety CPU 1 16 detects an error in the verification routine it notifies the 
10 host CPU 110 and treats the failure in a manner to that of a triggered protective system, 
such as by displaying an error message or activating one of the indicators 104 and/or the 
buzzer 121. 

If the safety CPU 1 16 does not detect an error, it sends a signal to the host CPU 
1 10 indicating the tests were passed and notifying the host 1 10 that the host 1 10 may 
15 continue. The safety CPU 116 transfers back to the host CPU 110 the data stored in 
RAM 134 that was forwarded from the host 110 (while keeping a copy in RAM 134), 
and the CRC calculated by the safety CPU. This data is stored in work space in the host 
CPU's RAM 132. 

The host CPU 1 10 then compares the CRC calculated by the safety CPU 1 16 to 
20 the host's CRC value, compares all the parameter values returned by the safety CPU 116 
to the values it originally sent, and treats any mismatch in a manner similar to that of a 
triggered protective system. 

If the comparison is valid, then the host CPU 1 16 updates the screen display with 
the parametric values returned by the safety CPU and stored in RAM 132. The host 
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CPU 110 then causes the touch screen 14 to display a prompt to the user that they must 
press the green hard key 1 8 to confirm the pending change to the displayed parametric 
value. Note that, up until this point, the data associated with the changed parameter is 
not yet loaded into the hard disk 130 that contains the program, and thus the machine 

5 cannot operate in accordance with the selected parametric value. Rather, a confirmation 
step must still occur, i.e., a pressing of the green hard key 1 8 off of the touch screen. 

When the user presses the green hard key 1 8 to confirm the change, the host 
microprocessor calculates a new CRC file and then writes the RAAt 132 copy of the 
parameters and the CRC to the hard disk 130. The safety CPU 116 simultaneously 

10 performs the same actions with its copy of the CRC and the parameters stored in RAM 
134, writing the RAM copy and CRC value to its hard disk 123. Both host and safety 
CPUs will then reload their sets of parameter and CRC data into their respective RAM 
and verify with each other that the new CRC value agrees with each other. The host 
CPU 110 then removes the "Press the green key to confirm" prompt and enables a 

15 screen navigation prompt allowing the user to navigate through other screens. At this 
point, the user can either navigate off the screen of Figure 6 or select another parameter 
for editing. The changing of the parametric value is now complete since the parametric 
value data is loaded into the hard disks of the host and safety CPU. 

While the above discussion has assumed that the user only modifies one of the 

20 several parameters from the display of Figure 6, the user may choose to modify another 
parameter on the same screen after the blue hard key 16 has been pressed. The user does 
not have to press the green hard key for every single parameter change. For example, 
the user may select a new blood flow rate (using icon 142), then press the blue hard key 
16 to signify completing of the editing process, select a new fluid removal rate (using 
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icon 146), then press the blue hard key 16, then edit the dialysate temperature (using 
icon 150), and then press the blue hard key 16. After each pressing of the blue hard 
key 16, the above-described verification routine is performed. If the verification 
routine results in a positive result for each pressing of the blue hard key, the display will 
5 continue to display a *'press the Green hard key to confirm" prompt. The user will press 
the green hard key once to confirm that they intend to change all the parametric values 
lhai have been selected. 

Smcc the new updated parametric value(s) are now entered into the hard disk 
mcnn^r\ I/O, ihc host CPU 110 commands the relevant active components of the 

10 niachmc lo in accordance with the new parametric value. 

Ihis use of the hard keys in the process of changing parametric values is 
considered ti> he distinctly different and an improvement from merely touching the 
touch screen \o enicr or change values, since the touch screen can be prone to failures. 
Failures m a touch screen to properly respond to a touching of the surface can arise in a 

15 variety of ways, such from mechanical failures due to repeated use over a prolonged 
period of lime, the screen surface material taking on a depression or set in a particular 
area from repealed use, electro-static shock causing the grid to fail in particular area, 
high electromagnetic fields causing the contacts to touch, cleaning agents leaking 
around the periphery of the screen, and so on. By also using hard keys or physical 

20 switches directly wired to the host and safety CPU to change values, the 
microprocessors have an independent means for determining whether the user has 
entered values or intends to confirm the changes. Further, by virtue of connecting the 
hard keys to both microprocessors, and using the pairs of redundant host and safety 
memories to check against each other, a failure in either microprocessor or associated 
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memories will be detected, allowing for alarms or other protective action to be initiated 
while maintaining patient safety. 

The above-described method of using the touch screen and hard keys to change 
machine or treatment parameters is also applicable to changing operational modes in the 
5 machine. For example, if the machine 10 is in a prepare dialysate solution mode, the 
display 14 may display a prompt indicating that the user should press the green hard key 
to indicate that they are ready to enter into a prepare access site mode or a dialyze mode. 
Another example would be when the user is finishing the dialysis session and indicates 
to tlie machine that they are ready to end dialysis and begin a rinseback mode. The user 
10 is prompted to press a hard key (e.g,, the green hard key) to indicate that they wish to 
confinn that they are ready to start the next mode of operation. Further, by virtue of the 
connection of the hard keys to both the host and safety CPUs, a verification routing can 
be performed by both CPUs to confirai that the machine is in a state where the change is 
mode is safe for the patient. 
15 For some mode changes, it is presently contemplated that little or no user 

interaction with the machine is necessary. For example, the transition from a clean and 
rinse mode to a prepare dialysate solution mode may be made without requiring user 
involvement. However, the current mode of operation is preferably communicated to 
the patient, such as by displaying a message telling the user what mode the machine is in 
20 (e.g., clean and rinse mode) and an illustration communicating how much time remains 
until the machine has completed the present mode. 

It will be appreciated that various modifications may be made to the methods 
described herein without departure from the true scope and spirit of the invention. 
Furthermore, as used in the claims, the term "touch screen" is intended to mean the 
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combination of the transparent physical surface touched by the user and the display 
immediately behind the surface touched by the user. The term "hard key", as used in the 
claims, is not intended to be limited to a button or key having two physical switches 
directed to host and safety CPUs, but rather, unless otherwise stated, is intended to mean 
5 simply a manually manipulable physical switch off of the touch screen such as a button 
operatively connected to a central computer system for the medical instrument. This 
true scope and spirit is defined by the appended claims, interpreted in light of the 
foregoing specification. 
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WE CLAIM: 

1 . A system for controlling the operation of a dialysis machine, comprising, in 
combination: 

a) a user interface comprising : 

5 1 ) a touch screen displaying messages and information as to said machine to a user 

and permitting said user to touch said touch screen to select at least one 
parametric value pertinent to operation of said machine or pertinent to a 
ircatmcni by said machine, and 
2 ) at Icasi one hard key off of said touch screen, said touch screen prompting said 

10 user u> press said hard key to signify that the selection of said at least one 

poramcinc value by said user has been completed; 

b) a conirol system within said machine for controlling operation of said machine 
and responsive to said touch screen and said at least one hard key, said control system 
comprisini! a host microprocessor and a safety microprocessor operatively connected to 

15 each other so as lo enable an exchange of information related to said at least one selected 
parametric value, 

c) said pressmu of said hard key causing said host and safety microprocessors to 
undergo a verification routine whereby said selected parametric value is checked for 
appropriateness for a patient connected to said machine so as to prevent changes to 

20 said parameter potentially harmful to said patient. 

2. The system of claim 1 , wherein said hard key is directly wired to said safety 
microprocessor so as to permit said safety microprocessor to respond to a pressing of 
said hard key. 
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3. The system of claim 1, wherein said user interface comprises first, second and 
third hard keys, said first hard key associated with an emergency stop fimction for said 
machine, said second hard key associated with an entry function for entering said 

5 selected at least one parametric value, and said third hard key associated with a 
confirmation function for confirming that the at least one entered parametric value is 
intended by said user of said machine, said touch screen prompting said user to touch 
either said second hard key or said third hard key after said user has touched said touch 
screen to select said at least one parametric value. 

10 

4. The system of claim 1, wherein said user interface comprises at least first and 
second hard keys, said first hard key having a first color and said second of said hard 
keys having a second color distinctly different fi"om said first color. 

15 5. The system of claim 4, wherein said user interface comprises a third hard key 
having a third color, wherein said first color comprises red, and said third color 
comprises green. 

6. The system of claim 1, wherein said user interface comprises first, second and 
20 third hard keys, each of said first, second and third hard keys hard wired to said safety 

microprocessor. 

7. The system of claim 1, wherein said user presses a second hard key to confirm that 
said selected at least one parametric value is intended by said user. 

27 

SUBSTITUTE SHEET (RULE 26) 

BNSDOCID: <WO_9S3S747A1J_> 



. wo 98/35747 



PCT/US97/13969 



8. In a dialysis machine Iiaving a user interface and a central computer system to 
control the operation of said dialysis machine, said user interface having a touch screen 
enabling a patient, by touching the touch screen, to select parametric values in a process 

5 of changing a parametric value pertinent to operation of said machine or pertinent to a 
dialysis treatment of a patient connected to said machine, the improvement comprising: 
providing said user interface with at least one hard key; 
connecting said hard key to said central computer system, and 
after said user has selected said parametric value by touching the touch screen, 

10 prompting said user of said machine to press said hard key to either 

(a) enter said parametric value selected by touching said touch screen, or, if 
entry of said selected parametric value is accomplished by touching the touch 
screen, 

(b) confirm the entry of said parametric value, 

15 so that a failure in said touch screen to respond to touching of the touch screen to 

either enter or confirm parametric value changes may be avoided. 

9. The improvement to a dialysis machine of claim 8, wherein said improvement 
further comprises: 

20 providing said central computer system with a host microprocessor and a safety 

microprocessor and connecting said hard key to both said host microprocessor and said 
safety microprocessor, with said hard key directly wired to said safety microprocessor. 
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1 0. The improvement to a dialysis machine of claim 8, wherein said improvement 
further comprises: 

providing said user interface with first, second and third hard keys, said first hard 
key associated with an emergency stop function for said machine, said second hard key 
5 associated with an entry function for entering said selected parametric value, and said 
third hard key associated with a confirmation function for confirming that the entered 
parametric value is intended by said user of said machine, said touch screen prompting 
said user to touch said second hard key after said user has touched said touch screen to 
select said machine operation parameter. 

10 

11. A method of changing a parametric value pertinent to operation of a dialysis 
machine, said machine having a user interface comprising a touch screen, a first hard 
key and a second hard key, and a control system responsive to said first and second hard 
keys comprising a host microprocessor and a safety microprocessor, said host and 

15 safety microprocessors each having a first memory and a second memory storing 
machine operation instructions, the method comprising the steps of: 
a) displaying on said touch screen a display permitting a user to touch said touch 
screen to select a parametric value associated with a parameter pertinent to operation of 
said machine or pertinent to a dialysis treatment conducted by said machine; 

20 b) pressing said first hard key to enter said selected parametric value, said control 
system responsively storing said selected parametric value in said first memory 
associated with said host microprocessor; 

c) in response to pressing said hard key, transmitting data associated with said 
parametric value and said parameter from said host microprocessor to said safety 
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microprocessor and implementing a verification routine in said safety microprocessor, 
wherein said parametric value is checked for appropriateness for a patient connected to 
said machine so as to prevent changes to said parameter potentially harmful to said 
patient; 

5 d) if said verification routine has a positive result, prompting said user to press said 
second hard key to confirm the change selected in step a) and responsively pressing said 
second hard key and storing said data associated with said parametric value in said first 
memory associated with said safety microprocessor; 

c) storing in said second memory associated with said host and safety microprocessors 
10 said data associated with said parametric value; and 

0 checking, with said host and safety microprocessors, the contents of their respective 
first and second memories against each other to insure that said data associated with 
said parametric value has in their respective first and second memories is the same. 

15 1 2. The method of claim 1 U wherein said second memory associated with said host 
microprocessor comprises a hard disk storing a prescription for a patient using said 
machine. 

13. The method of claim 11, wherein said first and second hard keys are directly 
20 connected to said safety microprocessor. 

14. The method of claim 11, wherein said verification routine comprises the steps 
of: 



30 

SUBSTITUTE SHEET (RULE 26) 



BNSDOCID: <WO_9B3S747A1 J_> 



.wo 98/35747 PCT/US97/13969 

calculating with said host microprocessor a first cyclical redundancy check value 
associated with said selected parametric value; 

transmitting from said host microprocessor to said safety microprocessor, in 
addition to said parametric value, said first cyclical redundancy check value, a first 
5 identifier associated with a screen displayed by said touch screen during said step of 
selection of said parametric value, and a second identifier associated with said 
parameter; 

calculating with said safety microprocessor a second cyclical redundancy check 
value associated with said data; 
10 verifying with said safety microprocessor fi*om said first and second identifiers 

that said touch screen could display said screen given the current state of said machine 
and that said parameter may be changed on said screen; 

verifying with said safety microprocessor that said parametric value associated 
with said data is within a predetermined range associated with said parameter, and 
15 verifying with said safety microprocessor that said second cyclical redundancy 

check matches said first cyclical redundancy check; and, in the event that said 
verification steps result in a positive result, 

transmitting an approval signal from said second microprocessor to said first 
microprocessor indicating that said positive result was achieved. 

20 

15. An improved user interface and screen display apparatus for a dialysis machine 
that promotes ease of use of said user interface by a user operating said machine without 
immediate supervision by trained professional medical personnel, comprising: 
a) a touch screen; 
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b) a screen display for said touch screen, said screen display arranged in at least 
two portions extending across said display, said at least two portions 
comprising: 

1) a first portion displaying instruction and status information to a user 
5 of said machine; and 

2) a second portion adjacent to said first portion on said display and 
displaying a plurality of icons, each of said icons associated with a 
specific functional activities associated either with said machine or a 
treatment session of said machine; and 

10 c) at least one hard key associated with said display, said first portion of said 

screen display prompting said user to press said at least one hard key in a process of 
entering or confirming entry of information into said machine. 

16. The apparatus of claim 15, wherein at least one of said icons is selected from 
15 the group of icons consisting of treatment icon, a schedule icon, a prescription icon, and 

a setup and care icon. 

17. The apparatus of claim 15, wherein said first and second portions are arranged 
above each other and extend across the width of said display, and wherein said screen 

20 display further comprises a third portion adjacent to said first and second portions, and 
wherein said third portion of said screen display displays a plurality of icons, at least one 
of said icons associated with a message transmission or receiving function for said 
dialysis machine. 
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18. An ergonomically efficient and easy to use human interface for a dialysis 
machine, said dialysis machine having an enclosure containing hydraulic circuitry for 
said machine comprising: 

an arm having a proximal end connected to said machine and a free distal end 
5 portion; 

a display assembly connected to said free distal end portion of said arm, said 
display comprising a touch screen, 

wherein said proximal end of said arm is mounted to said machine in a manner 
permitting said arm to rotate about at least one axis relative to said machine to thereby 
10 position said display at the distal portion thereof in a muhitude or different positions 
relative to said machine; and 

wherein said display is connected to said free distal end portion of said arm by a hinge 
means for permitting a user of said machine to rotate said display about at least one axis 
relative to said arm. 

15 

19. The apparatus of claim 18, further comprising a second hinge means connected 
to said display for permitting said display to be rotated relative to said arm about a 
horizontal axis. 

20 20. The apparatus of claim 1 8, wherein said display further comprises at least one 
hard key mounted adjacent to said touch screen in said display assembly. 

2 1 . The apparatus of claim 20, wherein said display assembly further comprises 
three hard keys mounted adjacent to said touch screen. 
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22. The apparatus of claim 21, wherein said three hard keys are each a distinctly 
different color. 

23. The apparatus of claim 21, wherein said three hard keys are each a distinctly 
different color and wherein at least one of said hard keys has a distinctly different shape 
from the other two hard keys. 

24. An ergonomically efficient and easy to use human interface for a medical 
instrument especially suited for use by a user other than trained professional medical 
personnel, comprising: 

a) a display assembly comprising a housing having a front surface; 

b) a touch screen incorporated into said front surface; 

c) a plurality of hard keys incorporated into said front surface placed adjacent to 
said touch screen, said touch screen displaying a message prompting said user to 
press both said touch screen and at least one of said hard keys during operation 
of said human interface of said medical instrument to change a parameter 
pertinent to said instrument or pertinent to a treatment performed by said 
instrument on said patient; 

d) wherein each of said plurality of hard keys presents a substantially different 
visual appearance to a user so as to readily permit said user to associate each of 
said plurality of hard keys with a different functional attribute associated with 
said operation of said human interface. 
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25, The user interface of claim 24, wherein said plurality of hard keys comprise first, 
second and third hard keys each having a distinctly different color. 

26. The user interface of claim 25, wherein said first hard key has a red color and 
5 associated with a emergency stop function , said second hard key having a blue color 

and associated with an entry function, and said third hard key has a green color and 
associated with a confirmation function, said first second and third hard keys located 
aJiaccni said touch screen on said front surface of said display. 

10 27. 7 he user interface of claim 25, wherein said display assembly is mounted to a 
free end o\ an ann connected to said medical instrument, with said display rotatable 
rclattx c to said arm about at least one axis. 

28. Tlic user interface of claim 25, wherein at least one of said hard keys has a 
15 distinctly different shape from the other two of said hard keys. 

29. The user interface of claimlS, further comprising a handle portion below said 
touch screen comprising a lower lip enabling a user to grasp said user interface housing 
and a front surface extending across a portion of the width of said housing, said lower 

20 lip and said from surface enabling a user to manually manipulate said user interface 
housing in a manner to cause rotation of said user interface about said at least one axis 
relative to said machine and said at least one axis relative to said arm 
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Description 

[0001] The present invention relates to a new and 
improved dialysis machine and method of validating 
information entered by a machine operator to control 
the machine during dialysis treatment. More particu- 
larly, the present invention effectively confirms that the 
entered information is what the operator intended and 
that the machine validly accepted the information, all of 
which occurs more conveniently for the operator while 
maintaining safety according to commonly accepted 
safety standards. 

Cross Reference To Re lated Inventions 

[0002] This invention is related to the inventions 
described in U.S. patents for a Graphical Operator 
Machine Interface and Method for Information Entry and 
Selection in a Dialysis Machine, U.S. Patent No. 
5,609,770, and for a Single Microcontroller Execution of 
Control and Safety System Functions in a Dialysis 
Machine, U.S. Patent No. 5,618,441 . both of which were 
filed concurrently herewith. The disclosures of these 
patents are irKX)rporated herein by this reference. 

Background of the Invention 

[0003] In general, a dialysis machine is used as a sub- 
stitute for the natural kidney functions of a human body. 
As such, the dialysis machine cleanses the blood of the 
natural accumulation of bodily wastes and separates 
the wastes from the blood outside of or extracorporeal ly 
of the body. The separated wastes are discharged, and 
the cleansed blood is returned to the body. 
[0004] The wastes are separated from the blood in a 
dialyzer. The dialyzer includes an internal housing 
which is separated by a porous medium into a blood 
side or compartment and a dialysate side or compart- 
ment. The blood removed from the patient f tows through 
the blood side of the dialyzer. A prepared solution of dia- 
lysate is passed through the dialysate side of the dia- 
lyzer. The wastes from the blood pass through the 
medium by osmosis, ionic transfer or fluid transport into 
the dialysate and. depending upon the type of dialysis 
treatment, desirable components from the dialysate 
may pass in the opposite direction through the medium 
and into the blood. The transfer of the wastes into the 
dialysate cleanses the blood while allowing the desired 
components from the dialysate to enter the blood- 
stream. 

[0005] As is apparent, the dialysis machine must be 
properly operated to perform effective dialysis in a safe 
and reliable manner. With the blood of the patient being 
removed and handled outside of the patient's body In an 
extracorporeal flow path, care must be taken that the 
treatment progresses safely and as Intended according 
to the dialysis prescription for the patient. Since the 
patient's blood and the dialysate separated only by the 



dialyzer medium, it is apparent that numerous safety 
concerns must be satisfied on a continual and reliable 
basis. 

[0006] Because of the potential for extremely serious 

5 consequences resulting from a failure or other unsafe 
condition, modern dialysis machines incorporate a large 
number of safety features as well as extensive control 
system features. The safety features include sensors 
located in the extracorporeal and dialysate flow paths to 

10 derive signals representative of the operating conditions 
or parameters which indicate the proper operation of the 
dialysis machine and/or the early development of a 
safety or risk condition. The control system features 
result in operational control over the pumps, dialysate 

75 heater, flow control valves and other devices associated 
with the extracorporeal and dialysate flow paths. 
[0007] Because of the pre-eminent importance of the 
safety system, all known modern dialysis machines uti- 
lize microcontrollers or similar types of processor 

20 devices to execute the safety functions. Generally 
speaking, modern microcontrollers offer a greater pos- 
sibility of more effective control over the safety features 
than other types of safety systems. Typically one micro- 
controller is used to execute the safety functions, and at 

25 least one and frequently two other microcontrollers exe- 
cute the control system functions. Upon recognizing a 
safety or risk condition, the safety microcontroller takes 
control of the dialysis machine and places it in a safe 
state which prevents or greatly reduces the risk of injury 

30 to the patient. 

[0008] In large measure, the use of separate micro- 
controllers for the safety and control systems is a result 
of the relatively stringent standards established by gov- 
ernmental, health and safety groups pertaining to dialy- 

35 sis machines. The multiple-microcontroller approach to 
achieving the basic safety and control system functions 
satisfies the regulatory standards by making the func- 
tionality of the safety system microcontroller irvjepend- 
ent of and separate from the functionality of the control 

40 system microcontroller. 

[0009] The safety standards also apply to the entry of 
the information when setting up the machine to perform 
the dialysis treatment, as well as to the entry of informa- 
tion during the progress of the treatment. In general, the 

45 safety standards are concerned with promoting opera- 
tor accuracy when entering information, and assuring 
that the entered information is not corrupted before it is 
used by the control system and safety system microcon- 
trollers. 

50 [001 0] Since in some cases the machine can not pro- 
tect against an operator-generated human error, many 
dialysis machines require the operator to enter informa- 
tion twice before the microcontrollers will accept the 
information. The theory behind th' double-entry 

55 requirement is that the operator is more likely to recog- 
nize an error if the operator is required to check, view or 
consider the entered information twice. Generally the 
first entry results in the information being recorded in 
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memory and then displayed to the operator. After the 
operator has again entered the same information, the 
microcontroller compares the first and second entries. If 
the two entries are the same, the first entry previously 
recorded in memory will be transferred to the control 5 
system and safety system microcontrollers for use dur- 
ing the treatment. Other typical information errtry tech- 
niques used in dialysis machines display the second 
entry in a separate location from the display of the first 
entry The operator must then mentally compare the two 10 
enteied values, and if they are equal, accept the 
entered value. In this double-display technique, the dial- 
ysis machine does not make the comparison, but 
instead leaves the comparison to the operator. 
[0011 J An eiample of a prior art double-display infor- 15 
mation efitiy lechnK^ue is provided In U.S. Patent No. 
5.247 434 wMerem an operator enters dialysis machine 
corttroi rtic»«rMtK3n tvough the use of a touch screen 
key pad Once tniormation has been entered (i.e., 
once tr>e opoaio nat pressed an ENTER button), the 20 
dialysis machi-** d«piay« fr^ newly entered information 
on the toucti icf and prompts the operator to verify 
that the new iHor^nabon 9% accurate. The disclosed ver- 
ification pf ocfx^s « r»**^rned by requiring the operator 
to press a VF RiPY button on the touch screen within a 25 
predetetrmnec amount of time (e.g. five seconds). 
Thus, the disclosed doutie-display technique requires 
an operatof to manuaBy verify each information entry. 
[0012] While the doUWe-entry and double-display 
techniques have generally proved successful, it is 30 
somewhat teckous. repettious and time-consuming for 
the operator The typcal machine setup procedure 
requires the entry of a significant number of different 
values, and the tme associated with the double-entry 
detracts from the other activities required to ready the 35 
machine for treatment. Furthermore, the repetitiveness 
of the entries can lead to a type of monotony which may 
cause the operator to be less vigilant in visually compar- 
ing the two displayed values, or which results in a cer- 
tain level of tension and tedium resulting from making 40 
the second entry or which results in frustration when 
the operator erKounters difficulty In correctly entering 
the information in sequential entries. 
[0013] These and other considerations have contrib- 
uted to the evolution of the present invention which is 45 
summarized below. 

Summary of the Invention 

[0014] One of the significant aspects of the present so 
invention pertains to an information entry system and 
method which requires the operator to enter the value 
only a single time, but which achieves a standard of val- 
idation that satisfies existing safety standards relating to 
the entry of information in dialysis machines. Another 55 
aspect of the invention relates to alerting the operator if 
the information which has been entered has been cor- 
rupted by the machine. Another aspect of the invention 



relates to entering and validating information in a man- 
ner which will assure that both the control system and 
safety system microcontrollers validly receive the same 
information which the operator has entered and 
approved. A further aspect of the invention relates to an 
information entry validation technique in which the 
proper functionality of certain input/output (I/O) devices 
is confirmed as an adjunct of the information entry. Still 
another aspect of the invention relates to a convenient 
and user-friendly technique for entering and confirming 
information used by a dialysis machine. 
[0015] In accordance with these and otiier aspects, 
the present invention pertains to a system and method 
for a dialysis machine in which entered control and 
safety information is validated. The machine includes an 
information entry device, for example a touch screen, 
arxJ a display device, for example a cathode ray tube 
(CRT). A safety system of the machine receives infor- 
mation entered from the entry device. The entered infor- 
mation is first converted into a first form using a first 
conversion relationship. The information in the first form 
is next converted into a second form using a second 
conversion relationship. The second conversion rela- 
tionship is different from the first conversion relation- 
ship Thereafter the information in the second form is 
converted back to the first form using the first conver- 
sion relationship. The information in the first form which 
resulted from the third conversion is displayed on a dis- 
play device for acceptance for rejection by the operator. 
[0016] The multiple sequential conversions provide 
the operator with an opportunity to evaluate the internal 
functionality of tfie machine and to determine if the 
machine has corrupted the entered information. A mal- 
function will usually result in the information being dis- 
played improperly or in an unusual form. Conversion of 
the information from one form into anotiier form is likely 
to reveal that a corruption problem has occurred. Pres- 
entation of the displayed information only after and 
based on tiie sequential multiple conversions assures 
an opportunity for the operator to evaluate the entries 
for accuracy. With sequential entries, each new entry is 
subjected to the same series of conversions, but the col- 
lective value of the previous sequential entries is dis- 
played. The re-display of the previously entered 
information repeatedly presents the information to the 
operator, but in a naturally-appearing manner which 
does not aeate tiie impression of duplicity, redundancy 
or multiple confirmation. As a result, the entered infor- 
mation is validated in a more time-conserving and relia- 
tHe manner, while reducing the operator's workload 
without compromising the degree of validation. 
[001 7] Preferred aspects of the invention involve using 
an ASCII conversion relationship for the first conversion 
and a floating p)oint numeric conversion relationship for 
the second conversion. The font table is employed to 
derive the information displayed to the operator. The 
use of the font table further confirms a state of proper 
functionality in the machine by notifying tiie operator if 
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the characters presented are improper or unusual. 
Improper or unusual characters would result from an 
error in the font table. Furthermore using the same font 
table to derive the characters for all of the displayed 
information has the additional benefit of confirming sig- 
nificant parts of the overall machine functionality, apart 
from the information entry. 

[001 8] Other preferred aspects of the invention involve 
storing the entered information in the second form into a 
third permanent memory location after the value has 
been previously stored in the second memory location. 
After the operator has accepted all of the values previ- 
ously entered, the information In the second and third 
memory locations is compared. If the comparison 
reveals equal values in both locations, the information in 
the third memory location is displayed to the operator in 
a location which is different from that location where the 
same information was displayed while the operator 
entered the information. The information displayed from 
the third memory location is thereafter transferred to the 
control system of the dialysis machine for use during 
operation of the machine. An error detecting code is 
also calculated from the information in the second mem- 
ory location and is stored In association with the infor- 
mation in the third memory location. The error detecting 
code is employed to validate the transfer of the informa- 
tion to the control system and/or the safety system. 
[0019] Many other preferred aspects of the present 
invention, and a more complete appreciation of the 
present invention and its scope, may be understood 
from the accompanying drawings, which are briefly 
summarized below, from the following detailed descrip- 
tion of a presently preferred embodiment of the inven- 
tion, and from the appended claims. 

Brief Description of the Drawinos 



[0020] 



Fig. 1 is a perspective view of a dialysis machine 
which incorporates the present invention. 
Fig. 2 is a generalized view illustrating a dialyzer, an 
extracorporeal flow path for blood from a patient 
through the dialyzer, and a fiydraullcs flow path for 
dialysate through the dialyzer, as are present dur- 
ing treatment of a patient with the dialysis machine 
shown In Fig. 1. 

Fig. 3 is a block diagram of the control system and 
safety system of the dialysis machine shown in 
Figs. 1 and 2, Illustrating the components which 
accomplish information entry validation according 
to the present Invention. 

Fig. 4 is an illustration of a screen display Initially 
presented on a monitor of the dialysis machine 
shown in Figs. 1 and 3. prior to entry of information. 
Fig. 5 is an Illustration similar to that shown In Fig. 
4, upon which a keypad is displayed for the entry of 
information. 
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Rgs. 6, 7 and 8 are screen displays similar to those 
shown in Figs. 4 and 5, which illustrate other dis- 
plays during the entry and validation of information 
according to the present invention. 
Figs. 9A and 9B collectively form a single flow chart 
which illustrates steps involved in the entry and val- 
idation of information by a operator machine Inter- 
face and safety microcontroller shown in Fig. 3. 
Fig. 10 is another illustration of some of the steps In 
the flow chart shown in Fig. 9A and the relationship 
of those steps with a temporary memory array and 
a temporary numeric memory shown in Fig. 3. 
Fig. 11 is an illustration of some of the steps in the 
flow chart shown in Fig. 98 and the relationship of 
those steps with a permanent memory shown in 
Fig. 3. 

Detailed Description 



20 [0021] An example of a dialysis machine with which 
the present invention may be advantageously employed 
is shown at 30 in Fig. 1. The dialysis machine 30 
Includes the devices generally shown in Fig. 2, and 
those devices establish an extracorporeal flow path and 

25 a hydraulics flow path. The extracorporeal ftow path 
conducts blood from a patient 32 to a dialyzer 34. and 
then returns the blood from the dialyzer 34 to the patient 
32. The hydraulics ftow path conducts dialysate from a 
supply 36 to the dialyzer 34. arxJ then returns the used 

30 dialysate to a waste drain 38. 

[0022] The blood in the dialyzer 34 is confined to a 
blood chamber 40, and the dialysate In the dialyzer 34 
Is confined to a dialysate chamber 42. The blood cham- 
ber 40 and the dialysate chamber 42 are separated by a 

35 micro-porous or other type of dialysis medium 44. The 
waste products contained in the blood within the blood 
chamber 40 are transferred through the medium 44 by 
osmosis, ionic transfer or flow transfer to the dialysate in 
the dialysate chamber 42. Desirat)le components of the 

40 dialysate in the dialysate chamber 42 may also be 
transferred to the blood in the Wood chamber 40 by the 
same mechanisms. In this manner, the waste products 
are removed from the patient's blood, and the cleansed 
blood is returned to the patient 32. The used dialysate 

45 f bwing from the dialysate chamber 42 discharges the 
waste products into the drain 38 which may be a publk: 
sewer. 

[0023] The elements of the extracorporeal flow path 
include at least one blood pump 46 which controls the 

50 flow of blood from the patient 32. An arterial line or tub- 
ing 48 extends through an arterial clamp 50 to a blood 
handling cartridge 52. The blood handling cartridge 52 
is normally retained behind a door 54 of the machine 30 
when used. The blood handling cartridge 52 is not 

55 shown in Fig. 1. The blood pump 46 also Is located 
behind the door 54 and adjacent to the cartridge 52. 
The blood pump 46 is typically a peristaltic pump in dial- 
ysis machines. 
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[0024] Blood flows through the arterial line 48 and into 
an arterial chamber 56 of the cartridge 52. The blood 
pump 46 draws blood from the arterial chamber 56 
through a pump tubing 58 which is squeezed or pinched 
by a rotating rotor 60 against a stationary raceway 62, in 5 
the typical manner of peri^altic punps. The blood 
within the pump tubing 58 which is trapped rotationally 
in front of the point where the rotor 60 pinches the pump 
tubing is propelled through the pump tubing 58 and into 
a manifold 64 of the cartridge 52. A tubing 66 conducts w 
the blood from the manifold 64 of the cartridge 52 into a 
blood inlet of the dialyzer 34. 

[0025] The cleansed blood flowing from an outlet of 
the dialyzer 34 is transferred through a tubing 67 back to 
a venous chamber 68 of the cartridge 52, Blood from is 
the venous chamber 68 is removed from the cartridge 
52 through a venous tubing or line 70. Although not 
shown in Fig. 2, a venous blood pump similar to the 
arterial blood pump 46 may be located in the venous 
line to assist in forcing the bloods back into the patient 20 
32 or to regulate the flow of blood through the extracor- 
poreal flow path. If employed, the venous blood pump is 
positioned behind a second door 72 of the dialyzer 
machine 30 shown in Fig. 1 . 

[0026] After leaving the venous chamber 68 the blood 25 
flows through the venous line 70 to an air detector 74. 
The air detector 74 derives signals related to any air in 
the venous line 70. If an excessive or dangerous 
amount of air is present, a venous line clamp 76 will 
immediately close to terminate the flow of blood through 30 
the venous line 70 before the air reaches the patient 32. 
[0027] Because the blood in the extracorporeal fbw 
path ts prone to clot, a blood anticoagulant such as 
heparin is injected into the extracorporeal flow path. The 
anticoagulant is slowly delivered from a syringe 78 as a 35 
result of a linear driver mechanism (not shown) moving 
a plunger 80 into the syringe 78. Anticoagulant from the 
syringe 78 is introduced into the arterial chamber 56 of 
the cartridge 52 through a tubing 82. The syringe 78 
and the linear driver mechanism are typically referred to 40 
as an anticoagulant pump. 

[0028] The elements of the hydraulics flow path 
include a nunt>er of different valves (some of which are 
not shown) and a dialysate pump 84 which draws dia- 
lysate from the supply 36. The supply 36 is typically a 45 
mixture of chemicals and water which the dialysis 
machine prepares as the dialysate is used, or a previ- 
ously prepared quantity of dialysate which is delivered 
to the dialysis machine 30. The dialysate pump 84 
draws the dialysate from the supply 36 and delivers it so 
through a dialysate supply tubing or line 86 to an inlet of 
the dialysate chamber 42 of the dialyzer 34. The dia- 
lysate flows past the medium 44 where it absorbs the 
waste products from the blood in the blood chamber 40. 
Any beneficial components within the dialysate which ss 
are desired to be transferred to the blood pass through 
the medium 44 and into the blood in the blood chamber 
40. 
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[0029] Prior to entering the dialyzer 34, the dialysate 
is heated in a heater 88 to the normal human body tem- 
perature. The temperature of the dialysate entering the 
dialyzer 34 should be at body temperature to avoid 
removing or transferring heat to or from the patient. 
Excessively warm dialysate will harm blood cells. 
Excessively cool dialysate will chill the patient. Temper- 
ature sensors (not shown) are located in the dialysate 
supply line 86 to monitor the temperature of the dia- 
lysate. 

[0030] Corxluctivity sensors (not shown) are present 
in the dialysate supply line 86 to measure the conductiv- 
ity of the dialysate. The desired level of ionic transfer 
between the blood and the dialysate is achieved by pre- 
determined conductivity characteristics of the dialysate. 
[0031 ] The used dialysate containing the waste prod- 
ucts is removed from the dialysate chamber 42 through 
a dialysate waste tubing or line 90 by operation of a 
drain pump 94. The dialysate containing the waste 
products is delivered by the drain pump 94 to the waste 
drain 38. The waste drain 38 may be a separate con- 
tainer which accumulates the used dialysate and accu- 
mulated waste products, or it may simply be a public 
sewer. 

[0032] As a safety precaution, bypass valves 96 and 
98 are positioned at the inlet and the outlet of the dia- 
lysate chamt)er 42, respectively. The bypass valves 96 
and 98 are connected by a bypass line 100. Normally 
the bypass valve 96 directs the inflow of dialysate into 
the dialysate chamber 42, and normally the bypass 
valve 98 directs the outftow of dialysate into the dia- 
lysate waste line 90. If a safety condition is detected, the 
Ijypass valves 96 and 98 are operated to their alterna- 
tive states, thereby directing the flow of dialysate 
through the bypass line 100. and bypassing the flow of 
dialysate around the dialyzer 34. 
[0033] The elements of the extracorporeal flow path, 
which have generally been described above, are shown 
and referenced generally at 1 10 in Fig. 3. The extracor- 
poreal flow path elements 110 are controlled by an 
extracorporeal microcontroller 112 or other similar 
processing device, as shown in Fig. 3. The extracorpor- 
eal microcontroller 112 executes a program recorded in 
a memory 1 14 to control the extracorporeal flow path 
elements 110. 

[0034] The elements of the hydraulics flow path, which 
have generally been described above, are also shown 
and referenced generally at 116 in Fig. 3. The hydrau- 
lics flow path elements 1 16 are controlled by a hydrau- 
lics microcontroller 118 or other similar processing 
device. The hydraulics microcontroller 118 executes a 
program recorded in memory 120 to control the hydrau- 
lics flow path elements 1 16. 

[0035] An operator/machine interface (OMI) and 
safety microcontroller 122 is also connected to the 
extracorporeal flow path elements 1 1 0 and the hydraulic 
flow path elements 116. The OMI and safety microcon- 
troller 122 monitors the operating conditions in the 
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extracorporeal and hydraulics flow paths, and upon 
detecting a potentially risky condition for the patient, 
assumes control over the extracorporeal and hydraulics 
flow path elements 110 and 116 to place them into a 
safe patient state. The safety microcontroller 122 exe- 
cutes a program recorded in its memory 124 to monitor 
the operating conditions of the dialyzer machine 30 and 
the patient 32 during dialysis treatment, to determine 
potentially hazardous conditions, and to place the dia- 
lyzer machine in a safe patient state upon the detection 
of a hazardous condition. 

[0036] The three microcontrollers 1 12, 118 and 122 
communK;ate with one another to exchange information 
and confirm proper functionality, among other things, by 
use of a bus o rtetwoik 126. In general, the extracorpor- 
eal n^ooooiitfoaei 112 and the hydraulic microcontrol- 
ler 118 are genefa«jr responsible for the control 
functions of the cte^yvs machine. The safety microcon- 
troller 122 G res<xyi&t]i« tor the safety functions of the 
dialysis mact«ne 

[0037] Um g# tne tf>M n^crocontrollers meets the 
safety standaicK lor diatyM machines. In general, the 
safety standards •npr^we redundancy to avoid the 
possibility thai a un^ eqiftpment failure will place the 
patient in a ha.*ardous conc^tion. If the failure of a con- 
trol system mK:focomrotier occurs, the safety system 
microcontrollef is capable of placing the dialysis 
machine in the safe patent state. For example, should 
the hydraulics maocontrolier 118 fail, the safety micro- 
controller 122 can assume control over the hydraulics 
flow path elements 1 14 to achieve the safe patient state. 
Similarly, should trie extracorporeal microcontroller 112 
fail, the safety mK:focontroller 118 will assume control 
over the extracorpaeal flow path elements 110 to 
achieve a safe patient state. If the safety microcontroller 
122 fells, the extracorporeal and hydraulics miaocon- 
trollers are capat^e of placing the dialysis machine in a 
safe patient state. 

[0038] Although it s typical to use multiple microcon- 
trollers in dialysis machines to meet the safety stand- 
ards, a dialysis machine which meets safety standards 
while using only a single microcontroller for executing 
the control system arxi safety system functions is 
described in the above mentioned U.S. Patent No. 
5.618.441 for a Single Microcontroller Execution of Con- 
trol and Safety System Functions in a Dialysis Machine. 
The present invention may be utilized with either single 
or multiple microcontroller dialysis machines. 
[0039] Because it is necessary to enter various types 
of safety and operational information to achieve a partic- 
ular dialysis treatment or prescription for a patient, the 
safety standards also govern the entry of information 
into the dialysis machine. In general, those standards 
are concerned with confirming to the operator that the 
information entered into the machine is what the opera- 
tor intends. It is also important that the operator know 
that the information entered is the information accu- 
rately stored in the memories 114, 120 and 124. The 



other general safety concern regarding information 
entry is that the safety miaocontroller 122 and the con- 
trol system microcontrollers 112 and 118 commence 
operations using the same entered information. If the 
5 safety and the control systems do not start with the 
same information, it will be extremely difficult or impos- 
sible to detect a difference in operation of the two sys- 
tems, and such a difference could give rise to a safety 
situation. 

10 [0040] The present invention achieves a more conven- 
ient and natural approach to entering and validating 
information into a dialysis machine, without compromis- 
ing the safety standards and while simultaneously sup- 
plying better information to the operator concerning the 

15 safety and operating conditions of the dialysis machine. 
[0041] The operator-machine interlace (OMI) is the 
means by which information is entered into the dialysis 
machine and by which the entered information is vali- 
dated back to the operator. The OMI functionality is 

20 incorporated with that of the safety microcontroller 122 
shown in Fig. 3, or could be performed by its own micro- 
controller. By entering all information through the safety 
microcontroller 122, it is assured that the control system 
microcontrollers 112 and 118 will start with the same 

25 values or information which is initially recorded in the 
safety microcontroller 122. 

[0042] The preferred means for entering and for dis- 
playing the entered information back to the operator is a 
conventional touch screen 130 attached to a front view- 
so ing surface of a conventional cathode ray tube (CRT) 
132. The touch screen 130 and the CRT 132 are incor- 
porated in a monitor 134 of the machine 30 shown in 
Fig. 1. 

[0043] The touch screen 130 is a thin transparent 

35 sheet assembly which physically overlays a front view- 
ing surface of the CRT 132. The overlaying relationship 
is generally illustrated in Fig. 3. With the touch screen 
130 in position, the images displayed on the viewing 
surface of the CRT 132 define locations which the oper- 

40 ator may select by applying finger pressure to the touch 
screen 130 at the location of the images. The touch 
screen 1 30 generates signals which describe the X-Y 
coordinates of the position where the finger pressure is 
applied. Those signals are supplied to a conventional 

45 touch screen converter 1 36 which converts the X-Y sig- 
nals from the touch screen 130 into corresponding sig- 
nals which are supplied to the safety microcontroller 
122. The programmed functionality of the safety micro- 
controller 122 correlates the signals from the touch 

50 screen converter 136 with the location of the images 
displayed on the viewing surface of the CRT 132. The 
correlation is possitile because signals are supplied by 
the safety microcontroller 122 to a video driver 138 to 
control the position and details of the images displayed 

55 on the viewing screen of the CRT 132. By correlating 
the X-Y position signals from the touch screen converter 
136 with the viewing images defined by the signals 
delivered to the video driver 138, the microcontroller 
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122 is able to recognize those selectior^ made by the 
operator touching the touch screen 130. This functional- 
ity is typical and well known for touch screen input and 
output (I/O) devices. 

[0044] To alert the operator in the case of a safety or s 
other condition, an audio alarm 140 and a visual alarm 
142 are used in the dialysis machine 30. The audio and 
visual alarms 140 and 142 are controlled by a driver 
144. The driver 144 responds to control signals supplied 
by the safety microcontroller 122 to create a visual io 
alarm or signal or an audio alarm or signal when neces- 
sary. 

[0045] An example of a visual display created by the 
safety microcontroller 122 and the video driver 138 is 
shown in Fig. 4. The visual display is shown as it i5 
appears on the viewing screen of the CRT 132. and it 
will therefore be referred to as a display screen 150. The 
display screen 150 Is divided Into different areas which 
present information concerning the functions arxJ status 
of the dialysis machine. A relatively large main window 20 
area 1 52 shows a number of setup parameters for con- 
trolling the dialysis machine during treatment, in this 
example. A title bar 154 Indicates that setup parameters 
shown in the main window 152. 

[0046] The eight setup parameters shown in the main 25 
window 1 52 are the patient identification number at 156. 
the type of dialysis treatment at 158. the time for the 
dialysis treatment at 160. the heparin Infusion rate dur- 
ing the treatment at 162, the dialysate flow rate during 
treatment at 1 64, the profile for delivering sodium in the 30 
dialysate during the treatment at 166, the profile for 
delivering bicarbonate in the dialysate during the treat- 
ment at 168. and the target loss or volume of waste 
products to the removed from the patient's blood during 
the treatment at 170. Other types of setup parameters 35 
could be displayed. U.S. Patent No. 5,609,770 
described above for a Graphical Operator Machine 
Interface and Method for Information Entry and Selec- 
tion in a Dialysis Machine describes an advantageous 
technique of selecting parameters and programming 40 
the dialysis machine. 

[0047] In addition to the main window 152. the right 
hand border (as shown) or some other selected area of 
the display screen 150 is occupied by images which 
allow the operator to select functional features of the 45 
display for purposes of entering information or monitor- 
ing the performance of the machine for the treatment. 
Touching a screen image 172 allows the operator to 
Index among various displays and, for example, select 
the setup parameters, as is shown of at 172 and 154. so 
Touching the touch screen above a last screen image 
1 74 allows the operator to toggle between the present 
display screen 150 and the previously presented display 
screen. Touching a treatment setup image 176 allows 
the operator to select from a list a dialysis functions that ss 
are expected to occur in conjunction with each treat- 
ment. A quick OPS image 178 allows the operator to 
select from a list of easy access functions that are not 
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necessanty expected in each treatment. 
[0048] The on and off operation of the blood pump 46 
(Fig. 2) is controlled by touching the blood pump icon or 
image 180. The blood pump is tumed on and off with 
each touch. The rate of blood pump operation may be 
adjusted incrementally upward or incrementally down- 
ward by touching an up arrow image 182 or a down 
arrow image 184. respectively. Continual finger pres- 
sure on either of the arrow images 182 or 184 causes 
repeated inaementation. When operating, the blood 
pumping rate is displayed in the location where the word 
"off" appears in the blood pump image 180. 
[0049] The bottom tK>rder or other designated area of 
the display screen 150 also includes a number of 
images or Icons which represent control and monitoring 
conditions associated with the patient and the dialysis 
machine. The image at 186 which states "resume" is 
selected to resume treatment if the blood pump opera- 
tion has been stopped. 

[0050] The image at 188 which states "UP" accompa- 
nied by a downward pointing arrow is selected when it is 
desired to reduce the amount of ultrafiltration which may 
be occun-ing during a treatment. Ultrafiltration is a well- 
known aspect of some types of dialysis treatments 
which involves the direct introduction of an ultrafiltration 
solution into the blood. The ultrafiltrate may be intro- 
duced into the extracorporeal flow path prior to the 
blood reaching the dialyzer 34 (Fig. 2) or after the blood 
has passed through the dialyzer. Of course, if ultrafiltra- 
tion is not used during the treatment, no functionality will 
be achieved by touching the ultrafiltration image 188. 
[0051] The image displayed at 190 is an icon repre- 
sentative of the dialyzer 34 (Fig. 2). Touching the dia- 
lyzer image 190 results in bypassing the dialysate flow 
around the dialyzer. The image or icon of a heart at 192 
allows the operator to obtain information concerning the 
patient's blood pressure, if a blood pressure monitoring 
functionality is a part of the dialysis machine and a 
tDlood pressure cuff is connected to the patient. 
[0052] Organization of the display screen 150 in this 
manner allows a more convenient, time-conserving, 
reliable and safety-promoting approach to setting up the 
dialysis machine and operating the machine during the 
treatment, as is described more completely in the above 
referenced U.S. Patent No. 5.609,770 for a Graphical 
Operator Machine Interface and Method for Information 
Entry and Selection in a Dialysis Machine. 
[0053] One of important safety-promoting aspects of 
the display screen 150 is its interaction with the operator 
and with the functionality of the OM I/safety microcon- 
troller 122 (Fig. 3) in validating information, particularly 
numeric values, entered by the operator during the 
setup of the machine for dialysis treatments and during 
modification of the operating parameters of the machine 
while the dialysis treatment is progressing. The aspects 
of the information validation technique according to the 
present Invention are represented in the flow chart 
shown in Figs. 9A and 9B. and are illustrated in the 
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screen displays shown in Rgs. 4-8. 
[0054] The steps of the technique shown in the flow 
chart of Figs. 9A and 9B are executed by the OM I/safety 
microcontroller 122 in conjunction with the memory 124 
connected to the microcontroller 1 22. Each of the steps 
shown in the flow chart of Figs. 9A and 9B are sepa- 
rately identified by reference numbers for convenience 
of description. 

[0055] In order to employ the information validation 
technique of the present invention, the operator must 
first select a parameter to be modified or estat^lished. 
The selection of the parameter is shown in Fig. 9A at 
step 200. TTie selection is also shown in Fig. 4 where 
the touch screen is touched in the area above the 
screen image 1 72. The screen image 1 72 is highlighted 
and the word "setup" appears. The fact that the setup 
parameters have been selected appears in the title bar 
154. The setup parameters which are available to the 
established or modified are shown in the main window 
152. 

[0056] For example, assume the operator desires to 
establish or change the value of the target loss of waste 
volume to the removed from the patient, as is displayed 
at 170. The operator presses the touch screen in the 
area above the target loss image 170 to select the tar- 
get loss setup parameter. The target loss image 170 is 
highlighted, as shown in Fig. 5, thereby indicating to the 
operator that the target loss parameter can now be 
established or modified. 

[0057] If the parameter selected for modification or 
establishment is one which allows selection of discrete 
numeric values, a keypad 202 (Fig. 5) is displayed on 
the display screen 150. The signals which define the 
keypad display 202 are created by the microcontroller 
122 and the video driver 138 (Fig. 3). and the CRT 132 
(Fig. 3) creates the keypad 202. The keypad 202 is pre- 
sented in place of some of the images which otherwise 
occupy the right hand and bottom border areas of the 
display screen 150. as can be seen by comparing Figs. 
4 and 5. 

[0058] The keypad 202 Includes areas which define 
numeric buttons 204. a selected parameter display area 
206 which presents a title corresponding to the parame- 
ter selected at 170. a decimal point button 208. an 
escape button 210, a clear button 212. and an enter but- 
ton 214. In addition, an up arrow 216 and a down arrow 
218 are located adjacent to the display area 206 to be 
used for incrementing the value of the parameter shown 
in the display area 206. either upwardly or downwardly. 
[0059] The logical and sensible display of the keypad 
202 provides the very important Information that the 
safety microcontroller 122 and a font table 220 (Fig. 3) 
of the memory 124 are correct and operating properly 
The font table 220 contains information from which the 
signals for creating the numbers In the keypad 202 are 
derived. If the numbers on the keypad 202 are not prop- 
erly formed, or if the numbers are not located In the 
positions where the operator expects them to he 



located, a malfunction can be immediately detected. 
The operator will recognize the malfunction as making 
the dialysis machine unreliable. Thus, the use of the font 
table 220 to create the keypad 202 is an important 

5 aspect of information supplied to the operator concern- 
ing the validation and proper functionality of the dialysis 
machine. Assuming that the information presented in 
the keypad 202 is correct, the operator will continue with 
the Information validation technique of the present 

10 invention and use of the dialysis machine. 

[0060] The described functionality which presents the 
keypad 202 is shown at step 222 in Fig. 9A. After dis- 
playing the keypad at step 222, the program flow ceases 
until an entry or selection made by touching the screen 

15 is detected at 224. A determination is made at 226 
whether the selection detected at step 224 was from the 
enter button 214 (Fig. 5) or from some other button from 
the keypad display 202. The purpose of the enter button 
214 Is to represent the final acceptance of all of the 

20 information or numeric values which have just been 
entered. Until the operator finally accepts the selected 
information by touching the enter button 214 (Fig. 5), 
the program flow will continue at the step 228. 
[0061] The step 228 involves converting the X-Y sig- 

25 nals from the touch screen 130 into an entry value 
obtained by touching the numeric buttons 204 (Fig. 5), 
by use of the touch screen converter 136 (Fig. 3) and 
the correlation of the signals from the converter 1 36 with 
the signals generated by the microcontroller 122 to dis- 

30 play the numeric values in the keypad 202 (Rg. 3). 
[0062] The entry value derived at step 228 is thereaf- 
ter converted at step 230 into an ASCII value. Typically 
the entry value determined at step 228 is directly mem- 
ory mapped to an ASCII value. ASCII values are 

35 employed for the purpose of displaying all of the num- 
bers and characters. 

[0063] Rather than immediately display the ASCII 
value derived from the step 230, the information entry 
validation technique of the present invention employs 

40 additional important steps to confirm the accuracy and 
acceptability of the entered value to the operator while 
simultaneously confirming the proper operation and 
acceptance of the value by the safety microcontroller. 
After the entered value is converted to the ASCII value 

45 at step 230, the ASCII value is stored at step 232 in a 
temporary array 234 (Fig. 3) of the memory 124. The 
temporary memory array 234 is a collection of memory 
locations or cells in which the ASCII value for each entry 
is separately stored. The individual locations or cells of 

so the array 234 to which the ASCII values derived from 
each entry are separately stored are shown individually 
at 236a, 236b, 236c,... 236n in Rg. 10. 
[0064] After the ASCII value has been stored in the 
temporary array at step 232, the microcontroller 122 

55 (Fig. 3) immediately converts the stored ASCII value 
into a different representation of the same information 
or value represented by the ASCII value, such as a 
numeric value, preferably a floating point numeric value. 
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The conversion to the different form is shown at step 
238 in Figs. 9A and 10. The numeric value derived at 
238 is stored at 240 in a temporary numeric memory 
location 242 (Fig. 3) of the memory 124. The temporary 
numeric memory location 242 is a segment or location 5 
within the memory 124 which the microcontroller 122 
designates for receiving the numeric value. 
[0065] Using the numeric value stored in the tempo- 
rary memory location at step 240, the numeric value is 
immediately converted back into an ASCII value at step 10 
244. TTie font table 220 (Fig. 3) may be used in this con- 
version if the inherent functionality associated with the 
conversion does not immediately convert the floating 
point numeric value into an ASCII value. The ASCII 
value thus derived is thereafter applied to the video is 
driver 138 (Fig. 3), and in response, the video charac- 
ters corresponding to the ASCII value are generated, as 
shown at 246 in Fig. 9A. The CFTT 132 (Fig. 3) displays 
the character to the operator as shown at 248 in Fig. 9A. 
The display of the value appears in the display area 206 20 
of the keypad 202 as shown in Fig. 6. Fig. 6 illustrates 
the arcumstance where the numeric "6" button 204 has 
been selected by finger pressure, resulting in the 
number "6" being presented in the display area 206 
(Fig. 6) In the example shown in Fig. 6, the entered 25 
value of "6" is the first value of 3 values to be entered. 
[0066] After the selected characters are displayed in 
the display area 206 (Fig. 6) of the keypad as shown at 
step 248 in Fig. 9A, the program flow reverts back to the 
step at 224 to detect another entry or selection of infor- 30 
mation. With each subsequent entry of information the 
steps beginning at 228 and ending at 248 are executed. 
However, each separate information selection is stored 
in a separate memory cell 236a, 236b, 236c ... 236n. 
shown in Fig. 10. In the example shown by comparing 35 
Figs. 6 and 7. the first ASCII entry (the numeric value 
"6") is stored in the cell 236a; the second ASCII entry 
(the decimal point) is stored In cell 236b: and the third 
ASCII entry (the numeric value "3") is stored in cell 
236c. If the entered information included additional 40 
selected values, all of the additional enti-ies would be 
stored to subsequent memory cells and the last or nth 
ASCII entry woukJ be stored in the last cell 236n. 
[0067] Each time a numeric value is derived at step 
238, all of the values which have previously been 45 
recorded in the cells 236a, 236b. 236c, ... 236n are used 
in the ASCII-to-numeric conversion, as is shown in Fig. 
10. In this manner, the value displayed at step 248 (Fig. 
9A) constitutes a measure of the collective accuracy of 
each value previously and presentiy entered. Since the so 
collective information of all of the previous values is 
used in the last ASCII to numeric conversion, rather 
than simply updating the infbrnfiation previously dis- 
played with each new conversion, any mistake in the 
selected values is likely to be recognized by the opera- 55 
tor. 

[0068] Furthermore, the entry and conversion tech- 
nique provides the operator with an effective indication 
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of whether the stored information may have become 
corrupted. Should the operator receive the display of a 
value which the operator did not enter, or if a previously 
entered value ajddenly changes witii a subsequent 
entry corruption of the entered information is sug- 
gested. A circumstance of a computational malfunction 
in the two conversions (ASCII to numeric, and numeric 
back to ASCII) might also be suggested. In either cir- 
cumstance, the operator is alerted to a potential mal- 
function within the dialysis machine, and the operator 
should recognize that the machine should not the used 
for the dialysis treatment. 

[0069] The use of the font table to display the values 
also provides a continuing indication of the functionality 
of the system. Preferably the font table is the only font 
table employed in the safety system for the display of 
information to the operator. By use of the single font 
table, the potential problems of corruptions of multiple 
font tables is avoided. Reference to a single font table 
for all displayed characters is more likely to reveal a mal- 
function within the system, since data displayed by use 
of the single font table will indicate con-uption through 
the improper display of that data. The likelihood tiiat the 
font table itself has become corrupted will be apparent if 
other information displayed to the operator is improper. 
These types visual cues provided through the display of 
information constitute a continuing integrity check of the 
functionality of the safety system microcontroller 122. 
[0070] Further still, the display of tine entered informa- 
tion also creates certain inherent protections against 
operator induced errors. The repetitive display of the 
information previously entered constitutes a require- 
ment that the operator continually accept the previous 
values as well as the present values entered. Each sub- 
sequent step of entering additional values inherentiy 
causes the operator to re-evaluate the previous infor- 
mation presented on tiie display area 206 of tiie keypad 
202 (Fig. 5). Consequentiy tiie entry process inherentiy 
creates a naturally-appearing requirement for reconsid- 
eration and re-validation of the previously entered infor- 
mation. However, this form of re-validation occurs 
inherentiy In conjunction with the natural process of 
entering each new value, not as an artificial and time- 
consuming requirement to specifically enter data twice 
or to look at data appearing in two different locations on 
the dialysis machine. Validation of the entered Informa- 
tion appears transparent to tiie operator, but the integ- 
rity of the validation does not compromise safety or 
encourage inattentive or slack practices by the operator. 
Entered information is validated in a manner which 
appears natural and second-natijre to the operator. The 
awkward, time-consuming and somewhat frusti-ation- 
prone necessity to continually compare two different 
values displayed at different locations on a screen, or to 
enter values twice, is avoided. 

[0071 ] After all of the information has been entered in 
the manner shown and described in conjunction witfi 
Fig. 9A. tfie resulting end value is displayed in the dis- 
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play area 206 of the keypad 202, as is shown by the 
example of the value "6.3" in Fig. 7. The value thus 
derived is stored in the temporary ASCII array 234 (Fig. 
3) and in the temporary numeric memory 242. Even 
though the desired value may be displayed correctly 
this value will not be accepted for use by either the 
safety microcontroller 122 or the extracorporeal or 
hydraulics microcontrollers 112 and 1 18 of control sys- 
tem. 

[0072] To make an entered value available for use by 
the control and safety system of the dialysis machine, 
the operator must select the enter button 214 as shown 
in Fig. 7. Selection of the enter button 214 initiates the 
program flow shown In Fig. 9B to assure that the infor- 
mation which has been validated by the operator will be 
recorded in a permanent memory segment 250 (Fig. 3) 
of the safety system memory 124. Once the value is 
recorded in the permanent memory segment 250, the 
control system mi aocont rollers 122 and 118 gain 
access to the information by reading the values in the 
permanent memory from the network 126. Touching the 
enter button causes the temporary ASCII memory array 
236a. 236b. 236c. etc. to become available for reuse 
during the same process with the next selected informa- 
tion. 

[0073] Detection of the enter button at step 226 
causes the microcontroller 122 to calculate a cyclic 
redundancy check (GRC) value based on the informa- 
tion contained in the temporary memory location 242. 
The calculation of the CRC occurs at step 252 as shown 
in Figs. 96 and 11 . A CRC is a value derived from the bit 
structure of the particular value contained in the tempo- 
rary memory location 242. and the CRC is used to 
detect errors that may occur from corruption of the value 
occurring after the CRC has been calculated. Enrors of 
this nature may sometimes arise from failures of mem- 
ory or due to corruption occurring when information is 
transferred to or obtained from memory within the com- 
puter system. The CRC may be calculated by using any 
number of well known CRC calculation algorithms. 
[0074] After calculation of the CRC at 252, the calcu- 
lated CRC is associated with the numeric value from 
which it was calculated, and the numeric value and its 
corresponding CRC are stored in the permanent mem- 
ory location 250 (Fig. 3), as shown at the step 254. The 
values stored In the permanent memory location 250 
are in a form acceptable for use and transfer between 
the safety system and the control system microcontrol- 
lers of the dialysis machine. However before the 
numeric and CRC values are made available for use by 
the management system, a further validation of the val- 
ues recorded in the permanent memory 250 is per- 
formed. 

[0075] The numeric value stored in the temporary 
numeric memory location 242 is compared at step 256 
to the numeric value stored in the permanent memory 
location 250. If the comparison at 256 reveals that the 
values in the two memory locations 242 and 250 are dif- 



ferent, an error has occurred and the value stored in the 
permanent memory 250 is not reliable or consistent with 
the value which has previously been validated and 
accepted by operator action as represented by the 

5 value located in the temporary memory 242. In this cir- 
cumstance, all previously entered values in the tempo- 
rary memory locations 234 and 242 and in the 
permanent memory 250 are erased at step 258 and the 
program flow reverts back to step 224 (Fig. 9A). Erasing 

70 the values causes the operator to commence again the 
information entry and valkJation procedure shown In 
Fig. 9A. 

[0076] If the comparison performed at 256 reveals that 
the values in memory at 242 and 250 are equal, the key- 

15 pad display 202 is erased from the display screen 150 
by the step shown at 260 in Fig. 9B. The absence of the 
keypad 202 from the display screen is shown in Fig. 8. 
Thereafter, the value in the permanent memory 250 is 
converted to an ASCII value, as shown at 262. Again. 

20 the font table 220 may be employed to make the conver- 
sion if it is not inherent In the program which establishes 
the numeric value. 

[0077] The microcontroller 122 supplies the ASCII 
value derived from the conversion at step 262 to the 

25 video driver 138, as shown at step 264, and the signals 
from the video driver 138 are used by the CRT 132 to 
display the final value, as shown at step 266. The final 
value displayed at 266 is the same value which was 
accepted by the operator by touching the enter button 

30 214 of the keypad 202. However, since the keypad 202 
has been erased at step 260, thefinal value is displayed 
on the setup parameter button 170 (Fig. 8) which was 
initially selected at step 200 to initiate the information 
entry and validation technique of the present invention. 

35 [0078] After acceptance of the value in the permanent 
memory as determined by the comparison at 256, the 
value in the permanent memory 250 is available to be 
transfen-ed to and used by the management system 
extracorporeal and hydraulics microcontrollers 112 and 

40 118, respectively. Transfer of the value to the microcon- 
trollers 1 1 2 and 118 results in that value being stored in 
their memories 114 and 120, respectively, as is shown 
at step 268. The use of permanent memory 250 (Fig. 3) 
for storing the values used by the safety microcontroller 

45 1 22 assures that those values wilt be available to the 
safety system after start-up following a power loss to the 
dialysis machine. 

[0079] The information entry validation technique of 
the present invention achieves a number of significant 

50 improvements for the operators of dialysis machines. 
The information entered by the operator is inherently 
validated in a convenient and time-conserving manner, 
as a natural adjunct to the entry of information itself. The 
entire value displayed is re-presented to the operator 

55 with each subsequent entry. Each subsequent entry 
therefore confirms all of the previous entries and 
presents the result to the operator. Should the operator 
have failed to recognize an error occurring from a previ- 
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ous entry, each subsequent entry of informatton 
presents another opportunity for the operator to recog- 
nize a previous error. Furthermore, the final entered 
value must be accepted by the operator by selecting the 
enter button to re-affirm the final acceptance of the 5 
entered information. The removal of the keypad upon 
selection of the enter button and the resulting display of 
the final value in the parameter setup txjtton requires 
the operator to again confirm the value. These proce- 
dures for presenting information to the operator tor con- 10 
firmation appear to the operator as natural sequential 
events, not the redundant and repetitious double-entry 
and double-display confirmation operations which are 
typical in the prior art. As a result, the operator is less 
likely to make mistakes arising from boredom, from inat- 75 
tention inherent in repeating redundant actions, or from 
tension and tedium caused by the typical double-entry 
requirements of prior art dialysis machines. Further- 
more, these significant operator advantages are 
obtained without compromising safety, and while meet- 20 
ing the safety and governmental standards which apply 
to dialysis machines. Further still, the present invention 
allows the operator to enter information more rapidly 
while still achieving these significant conveniences. 
[0060] The information entry validation technique of 25 
the present invention also offers significant improve- 
ments in the functional operations associated with the 
information entry and validation. The use of two sepa- 
rate conversions, such as ASCII to floating point 
numeric, serves as a double-check on the functionality 30 
of the machine. Furthermore the use of a single font 
table by which to achieve the conversions eliminates the 
possibility that errors could occur in one font table that 
were not present in another font table. The use of multi- 
ple memory locations to store values obtained from the 3S 
two conversions, and to store the permanent value sub- 
stantially reduces the possibility that an error in the 
memory might allow a corrupted value to be used by the 
dialysis machine. The comparison of the temporary and 
permanent values before the final value is accepted for 40 
use by the control and safety systems of the machine 
constitutes a further check on the validity of the 
accepted information. Many other significant improve- 
ments will be recognized after the present invention is 
fully comprehended and appreciated. 45 
[0081 ] A presently preferred embodiment of the inven- 
tion and many of its improvements have been described 
with a degree of particularity. This description is a pre- 
ferred example for implementing the invention, and is 
not necessarily intended to limit the scope of the inven- so 
tion which is defined by the following claims. 

Claims 

1 . A dialysis machine (30) having an information entry ss 
device (130) by which an operator enters control 
and safety information for treatment of a patient by 
the machine and a display device (132) by which an 



operator receives intemal information generated by 
the dialysis machine (30) describing the operation 
and safety conditions of the machine, said dialysis 
machine (30) comprising: 

a safety system connected to the information 
entry device (130) and the display device (132), 
the safety system including: 
a memory within which a single font tattle (220) 
is recorded; and 

means for controlling the display device (132) 
to display both the information entered through 
the entry device (130) and the interna! informa- 
tion generated by the dialysis machine (30) uti- 
lizing only the single font table (220). 

2. The dialysis machine (30) of claim 1 wherein: 

the display device (132) creates displays of 
information from the operator in response to 
the application of display signals to the display 
device (132); and 
the safety system is operative to: 

receive entered information from the entry 
device (130): 

generate internal information describing 
the operative conditions of the machine 
(30); 

correlate all entered and internal informa- 
tion to be displayed to the font table (220); 
create display signals corresponding to the 
entered and internal information from the 
con-elation to the font table (220); and 
apply the created display signals to the dis- 
play device (132) to display the entered 
and internal information. 

3. A method of displaying dialysis machine informa- 
tion which describes operational and safety condi- 
tions of the machine and treatment characteristics 
while simultaneously confirming proper internal 
operation of at least a part of the dialysis machine 
(30), said dialysis machine (30) having a memory, 
an information entry device (130) by which an oper- 
ator enters control and safety information for treat- 
ment of a patient by the machine and a display 
device (132) by which the operator receives internal 
information generated by the machine describing 
the operational and safety conditions of the 
machine, said method comprising the steps of: 

recording a single font table (220) in the mem- 
ory of the machine. 

displaying both the information entered through 
the entry device (130) and the internal informa- 
tion generated by the dialysis machine (30) 
using only the single font table (220). 
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The method of displaying dialysis machine informa- 
tion of claim 3 wherein the display device (132) cre- 
ates displays of information from the operator in 
response to the application of display signals to the 
display device (132); further comprising: 5 

receiving entered information from the entry 
device (130); 

generating internal information describing the 
operative condition of the machine (30); 10 
coaelating alt entered and internal information 
to be displayed to the font table (220); 
creating display signals corresponding to the 
entered and internal information from the cor- 
relation of the font table (220); and is 
applying the created display signals to the dis- 
play device (132) to display the entered and 
internal information. 
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